JSAC2024 Day2 (JAN 26th)
Analysis of Activities and Tools ofPhishing Actors Targeting JapanNTT Communications Corporation.
Yuichi Tsuboi, Masaomi Masumoto© NTT Communications Corporation All Rights Reserved.

Disclaimer•

In this lecture, I am discussing investigative activities using phishingcommunities. However, I do not encourage casually peeking intophishing actor activities or accessing phishing sites within the phishingcommunity.
• Contacting phishing actors, even with the sole purpose of observing, isan action that could potentially expose you to detection by the phishingactors.
• Please conduct such activities with consideration for your own security(OPSEC: Operational Security) and within the bounds of personal
responsibility.
© NTT Communications Corporation All Rights Reserved.

2

Speakers
Yuichi Tsuboi
NTT Communications Corporation
Cyber Threat Intelligence Operations Architect

Masaomi Masumoto
NTT Communications Corporation
Cyber Threat Intelligence Researcher© NTT Communications Corporation All Rights Reserved.

3

Overview• In recent years, there has been a rising trend in phishing scamincidents. The emergence of PhaaS (Phishing as a Service) has
contributed to the rapid expansion of the ecosystem, leading tofurther specialization and division of labor among "phishing actors"
involved in phishing scams.
• We have been engaged in tracking the activities of "phishingactors" to understand phishing scams better. Additionally, we haveconducted analyses of phishing kits that are actively being utilized
in order to comprehend the tactics employed.
• In this presentation, we aim to share insights, including casestudies of "phishing actor" activities and analysis results of phishingkits. We hope to contribute, even if only to a small extent, to theefforts of phishing hunters and those actively addressing phishingincidents.
© NTT Communications Corporation All Rights Reserved.

4

Agenda1.Recent Phishing Incidents
2.Phishing Communities
3.Phishing Actors' Activities
4.Analysis of Phishing Kits
5.Conclusion© NTT Communications Corporation All Rights Reserved.

5

Agenda1.Recent Phishing Incidents
2.Phishing Communities
3.Phishing Actors' Activities
4.Analysis of Phishing Kits
5.Conclusion© NTT Communications Corporation All Rights Reserved.

6

Recent Phishing Incidents• The Anti-Phishing Council has been publishing monthly reports on phishingincident status, and upon examining the data going back five years, it isevident that the annual number of phishing reports has been steadily
increasing.
• The number of reports for the year 2023 has reached 1,196,390 cases,
surpassing the 2022 figure of 968,832 incidents.
Number of phishing reports
1,500,000
968,832

1,000,000
526,504

500,000
0© NTT Communications Corporation All Rights Reserved.

1,196,390

55,787
2019

224,676

2020

2021

2022

2023
7

Recent Phishing Incidents• The comparison indicates a 1.2-fold increase over 2022, and over the fiveyear period from 2019 to 2023, the reported phishing incidents have
surged by approximately 20-fold. This substantial growth underscores theescalating threat posed by phishing activities during this timeframe.
Number of phishing reports

Increase of approx.
1,500,000
2000

1,196,390
968,832

1,000,000
526,504

500,000
55,7870© NTT Communications Corporation All Rights Reserved.

2019

224,676

2020

2021

2022

2023
8

Division of labor for phishing activities
As mentioned in the “Anti-Phishing
Guidelines, 2023 Edition" released by
the Phishing Countermeasure Council,
recent phishing incidents have shown a
specialized division of labor acrossvarious stages (planning, procurement,
construction, induction, deception,monetization, and reinforcement
expansion). This specialized structure
indicates a sophisticated and organizedapproach adopted by threat actors inphishing campaigns.

Indeed, the prevalence of phishing
services through Phishing as a Service(PhaaS) and the distribution of phishingkits within communities havecontributed to the increased ease of
executing phishing activities.

© NTT Communications Corporation All Rights Reserved.

Anti-Phishing Guidelines, 2023 Edition.
P.8 Figure 3. Complicated examples of phishing.
https://www.antiphishing.jp/report/antiphishing_guideline_2023.pdf
9

Division of labor for phishing activities• We have focused on the activities of phishing actors in phishingscams, tracked phishing actors targeting Japan, and conductedinvestigations into the trends of phishing communities wherethese actors interact.

© NTT Communications Corporation All Rights Reserved.

10

Agenda1.Recent Phishing Incidents
2.Phishing Communities
3.Phishing Actors' Activities
4.Analysis of Phishing Kits
5.Conclusion© NTT Communications Corporation All Rights Reserved.

11

Location of phishing actors activities

l Chat Tooll Trading Market Sitel Phishing Form Sitel etc.

© NTT Communications Corporation All Rights Reserved.

12Chat Tool(Telegram)© NTT Communications Corporation All Rights Reserved.

13

Trading Market Site(Tor)© NTT Communications Corporation All Rights Reserved.

14

Phishing Form Site

© NTT Communications Corporation All Rights Reserved.

15

Limited Public© NTT Communications Corporation All Rights Reserved.

16

Characteristics of the phishingcommunities studiedl An unspecified number of phishing actors are presentl Individual or groupl Phishing communities are sometimes divided by role

© NTT Communications Corporation All Rights Reserved.

17

Summaryl They operate in a variety of places, from the surface web to the dark web
l The distance to the actors can be closel Consists of an unspecified number of phishing actors© NTT Communications Corporation All Rights Reserved.

18

Agenda1.Recent Phishing Incidents
2.Phishing Communities
3.Phishing Actors' Activities
4.Analysis of Phishing Kits
5.Conclusion© NTT Communications Corporation All Rights Reserved.

19

Types of phishing actorsl Develops the tooll Operates the servicel Commits scaml Sell stolen informationl etc.

© NTT Communications Corporation All Rights Reserved.

20

Phishing scam flow
Setup

Start

Steal

Abuse

• Phishing kit• Send Mail

• Credential• Monetization• Server• Send SMS• Card Info

• Email• etc.

• etc.

© NTT Communications Corporation All Rights Reserved.

21

Limited Public© NTT Communications Corporation All Rights Reserved.

22

Summaryl Phishing actors in various roles are activel Phishing actors interact and cooperate with each other.
l Working across languages.

© NTT Communications Corporation All Rights Reserved.

23

Agenda1.Recent Phishing Incidents
2.Phishing Communities
3.Phishing Actors' Activities
4.Analysis of Phishing Kits
5.Conclusion© NTT Communications Corporation All Rights Reserved.

24

Analysis of Phishing Kits
• We conducted a content analysis of phishing kits obtained directlyfrom phishing communities among the cases discussed in"Regarding Phishing Communities" and "Activities of Phishing
Actors.”• Here are two analysis results introducing "which brand is being
discussed" and "what kind of actions are being described."© NTT Communications Corporation All Rights Reserved.

25

Case 1: Phishing Kit discussing Amazon© NTT Communications Corporation All Rights Reserved.

26

Case 1: Phishing Kit discussing Amazon

Most recently, it has been rampant until December 2023, and urlscan.io confirms its
continued usage into January.
•

infringing brand︓Amazon•

File Name︓JP亚马逊源码（防红防乱填）.zip（※ Translated into English, it means 「JP Amazon source code (anti-red and antifilling).zip」）•

File Hash（SHA1）︓58c55affaeb845ca5f5021730d4c2927b482bdc2© NTT Communications Corporation All Rights Reserved.

27

Case 1: Phishing Kit discussing Amazon
Debug mode settings

Inside main.php, there is a setting
for the debug mode.
When the debug mode is ON, thecloaking feature is activated to denyaccess from countries outside thespecified IP range and crawlers withspecific user agents.

© NTT Communications Corporation All Rights Reserved.

main.php28

Case 1: Phishing Kit discussing Amazon
Function Configuration

The phishing kit discussing Amazon is equipped with the following features:
1. Access Source Information Collection Function
2. Cloaking Function
3. Crawler Detection Function
4. Phishing Content© NTT Communications Corporation All Rights Reserved.

29

Case 1: Phishing Kit discussing Amazon
1. Access Source Information Collection Function

It collects the following information from the access source that accessed thephishing kit:
•
•
•
•
•

IP Address
Geographical Information
Client's OS Information
ISP Name associated with the IP Address
Web Browser used on the client© NTT Communications Corporation All Rights Reserved.

30

Case 1: Phishing Kit discussing Amazon
1. Access Source Information
Collection Function

Find and retrieve the valid IP
address from the request headers(HTTP_CLIENT_IP,
HTTP_X_FORWARDED_FOR,REMOTE_ADDR).

main.php© NTT Communications Corporation All Rights Reserved.

31

Case 1: Phishing Kit discussing Amazon
1. Access Source Information
Collection Function

Retrieve the client's OS
information from the User-Agentin the request header.

© NTT Communications Corporation All Rights Reserved.

main.php32

Case 1: Phishing Kit discussing Amazon
1. Access Source Information
Collection Function

Retrieve the information about the
web browser used by the clientfrom the User-Agent in therequest header.

main.php© NTT Communications Corporation All Rights Reserved.

33

Case 1: Phishing Kit discussing Amazon
1. Access Source
Information Collection
Function

Check if the country nameexists in the session information.
If the country name is not set in
the session information, use an
external service to retrieve thegeographical information of theaccess source IP address. If thecountry name cannot be
successfully obtained, utilize
another external service toobtain geographical information
in a two-step process.
main.php© NTT Communications Corporation All Rights Reserved.

34

Case 1: Phishing Kit discussing Amazon
1. Access Source Information
Collection Function

Retrieve the ISP name using
the external service (Extreme
IP Lookup) based on the accesssource IP address.

main.php© NTT Communications Corporation All Rights Reserved.

35

Case 1: Phishing Kit discussing Amazon

2. Cloaking Function
Operates when the debug mode is ON. Utilizes information collected by theaccess source information gathering function, such as "source IP address,""country," "OS information," "ISP," "browser," etc., to deny access undervarious conditions. The observed conditions are as follows.ホスト名• IP Range• User Agent• ISP• Browser and OS• Whether a VPN or Proxy is being used
• Whether the access source IP address has been previously compromised• Whether it is from Japan or outside Japan© NTT Communications Corporation All Rights Reserved.

36

Case 1: Phishing Kit discussing Amazon
2. Cloaking Function
Compare the hostname of theaccess source user with the defined
list of denied hostnames within thephishing kit and make adetermination.

blocker.php© NTT Communications Corporation All Rights Reserved.

37

Case 1: Phishing Kit discussing Amazon
2. Cloaking Function
Compare the access source IP
address with the defined list ofdenied IP ranges within thephishing kit and make adetermination.

© NTT Communications Corporation All Rights Reserved.

blocker.php

38

Case 1: Phishing Kit discussing Amazon
2. Cloaking Function
Compare the User-Agent of theaccess source with the defined list ofdenied User-Agents within thephishing kit and make adetermination.

blocker.php© NTT Communications Corporation All Rights Reserved.

39

Case 1: Phishing Kit discussing Amazon
2. Cloaking Function
Compare the ISP of the accesssource with the defined list ofdenied ISPs within the phishing
kit and make a determination.

blocker.php© NTT Communications Corporation All Rights Reserved.

40

Case 1: Phishing Kit discussing Amazon
2. Cloaking Function
Determine if the webbrowser of the access source
client is not defined within
the phishing kit as anallowed web browser.

blocker.php© NTT Communications Corporation All Rights Reserved.

41

Case 1: Phishing Kit discussing Amazon
2. Cloaking Function
Determine if the OS of theaccess source client is notdefined within the phishing
kit as an allowed OS.

blocker.php© NTT Communications Corporation All Rights Reserved.

42

Case 1: Phishing Kit discussing Amazon
2. Cloaking Function
If the access source isaccessing from somewhereother than the localhost, queryan external service for theaccess source IP address andcheck if the access source isusing a VPN or Proxy.

© NTT Communications Corporation All Rights Reserved.

blocker.php

43Case 1: Phishing Kit discussing Amazon
2. Cloaking Function
Check whether "once" is set
in the session.

api/api_session.php
It is inferred that "Once" is a flag indicating an accesssource that has already been compromised once.
Here, access from a source with information alreadystolen is denied.

© NTT Communications Corporation All Rights Reserved.

44

Case 1: Phishing Kit discussing Amazon
2. Cloaking Function
Define a list of allowed countries
and check whether the collected
country name is included in thelist of allowed countries.

api/api_session.php
Given that within this phishing kit, "Japan" or "JP"is defined as the list of allowed countries, it can beinferred that the kit is targeting only Japan.

© NTT Communications Corporation All Rights Reserved.

45

Case 1: Phishing Kit discussing Amazon

3. Crawler Detection Function
Utilize external tools like
CrawlerDetect andReferralSpamDetect to detect web
crawlers and referral spam.

crawlerdetect.php© NTT Communications Corporation All Rights Reserved.

Jaybizzle/CrawlerDetect/CrawlerDetect.php

46
Jaybizzle/ReferralSpamDetect / ReferralSpamDetect.php

Case 1: Phishing Kit discussing Amazon

3. Crawler Detection Function
In CrawlerDetect, confirm whether
specific strings are present in theUser Agent and make adetermination.
In ReferralSpamDetect, confirm
whether specific strings arepresent in the Referer URL andmake a determination.

crawlerdetect.php© NTT Communications Corporation All Rights Reserved.

47

Case 1: Phishing Kit discussing Amazon
4. Phishing Content
The phishing content is
structured using Vue.js. In theindex.html file, page routing is
performed using vue-router,
tailored to the processing of thephishing site. Various contents
are prepared, and multiple
JavaScript files are calledaccordingly.

© NTT Communications Corporation All Rights Reserved.

index.html

呼び出される番号JavaScript

48

Case 1: Phishing Kit discussing Amazon

4. Phishing Content

The following is the code referred to as the login screen for a phishing site.

© NTT Communications Corporation All Rights Reserved.

49

Case 1: Phishing Kit discussing Amazon

4. Phishing Content

The following is the code referred to as the personal information input screen.

© NTT Communications Corporation All Rights Reserved.

50

Case 1: Phishing Kit discussing Amazon

4. Phishing Content

The following is the code referred to as the credit card information input screen.

© NTT Communications Corporation All Rights Reserved.

51

Case 1: Phishing Kit discussing Amazon

4. Phishing Content

The functionality to obtain BIN (Bank Identification Number) codes using the entered credit card
information through an external service has also been implemented.

api/send_card.php© NTT Communications Corporation All Rights Reserved.

52

Case 1: Phishing Kit discussing Amazon

4. Phishing Content

The following is the code that is called upon submitting the 3D Secure input screen for thephishing site's PC version.

© NTT Communications Corporation All Rights Reserved.

53

Case 1: Phishing Kit discussing Amazon
4. Phishing Content
The information entered up to
this point is recorded in a text
file and sent via email to thephishing actor.

© NTT Communications Corporation All Rights Reserved.

api/send_3d.php

54Case 1: Summary• The phishing kit named "JP亚马逊源码（防红防乱填）.zip," which
discusses Amazon, is built using Vue.js. It conducts information
gathering from the request headers and sessions of the accessing
source, and implements detailed detection processes toincorporate cloaking techniques.
• Crawler detection processes are simplified by using external tools
such as CrawlerDetect and ReferralSpamDetect.
• The information entered on the phishing site is first outputted toa text file and then directly sent via email to the phishing actor.
© NTT Communications Corporation All Rights Reserved.

55

Case 2: Phishing Kit discussing SMBC

© NTT Communications Corporation All Rights Reserved.

56

Case 2: Phishing Kit discussing SMBC
Phishing kit mimicking SMBC's credit card services.

• Infringing brand: SMBC (Sumitomo Mitsui Banking Corporation)• File Name︓三井.zip• File Hash（SHA1）︓2a0a37dedffae95f46b2a51066e44c06058bf764© NTT Communications Corporation All Rights Reserved.

57

Case 2: Phishing Kit discussing SMBCREADME

It is evident that the phishing kit is built using ThinkPHP, as indicated by thepresence of a README.md file containing information about the operating
environment and instructions on how to use ThinkPHP.

© NTT Communications Corporation All Rights Reserved.

README.md

58

Case 2: Phishing Kit discussing SMBC
Configuration related

The configurable settings of thephishing kit are defined in PHP
files located under the config
directory.
When used by the phishing actor,
configuration changes are
typically made in files likepublic/static/config.js. This
allows customization of thedestination URL during cloaking
implementation, the use of theipregistry service through an API
key, and the specification of thestorage location for obtained
information.

public/static/config.js© NTT Communications Corporation All Rights Reserved.

59

Case 2: Phishing Kit discussing SMBC

Functional configuration
The phishing kit discussing SMBC incorporates the following features:
1.Access Source Information Collection Function
2.Cloaking Function
3.Crawler Detection Function
4.Phishing Content
5.Acquired Information Management Function© NTT Communications Corporation All Rights Reserved.

60

Case 2: Phishing Kit discussing SMBC
1. Access Source
Information Collection
Function
Utilize the IP Registry of
external services to acquire
access source information.

smbc/view/index/index.html© NTT Communications Corporation All Rights Reserved.

61

Case 2: Phishing Kit discussing SMBC
2. Cloaking Function
Conduct evaluation of accessdenial criteria defined in thephishing kit. The assessment
criteria are as follows:

smbc/view/index/index.html© NTT Communications Corporation All Rights Reserved.

62

Case 2: Phishing Kit discussing SMBC
2. Cloaking Function
Redirect to localhost if theaccess source user's operating
system is not iOS or Android(in other words, if it is not amobile device).

smbc/view/index/index.html

This behavior suggests that thephishing kit is targeting mobile
users.

© NTT Communications Corporation All Rights Reserved.

63

Case 2: Phishing Kit discussing SMBC
2. Cloaking Function
Check whether the accesssource user is using a specificconnection type (such as CDN,
hosting service, proxy, Tor, or
VPN) identified as abuser,
attacker, or for investigative
purposes. If the conditions
match, redirect to localhost.
It appears to be checking whether
the access is coming from anenvironment significantly different
from the typical environment that
regular users use.
© NTT Communications Corporation All Rights Reserved.

smbc/view/index/index.html
64Case 2: Phishing Kit discussing SMBC
2. Cloaking Function
In cases other than the resultsof the evaluation in ②,
perform the following process:If the "isLoad" item exists inthe local storage, redirect tothe value of the URL target set
in "configAll.”

Note that the configuration for
configAll.URLtarget is set insmbc/view/index/index.html
the value defined inpublic/static/config.js. The
Within this process, it is determining whether thedefault value at the time of access source has been compromised. If the accessacquiring this phishing kit issource has been compromised, it redirects to thehttps:/www[.]smbcgenuine SMBC site as configured.
card[.]com/.
© NTT Communications Corporation All Rights Reserved.

65

Case 2: Phishing Kit discussing SMBC
3. Crawler Detection
Function

Retrieve information such as
Referrer, UserAgent,ServerName, and other details
from the request information.
Define a list of disallowed
crawlers and check if thebrowser information contains
the name of any disallowed
crawler.
smbc/public/index.php© NTT Communications Corporation All Rights Reserved.

66

Case 2: Phishing Kit discussing SMBC

4. Phishing Content
The following is the code that calls the login page of the phishing site.

smbc/view/index/indexinfore.html© NTT Communications Corporation All Rights Reserved.

67

Case 2: Phishing Kit discussing SMBC

4. Phishing Content
Perform registration in the database upon pressing the "Submit" button.

smbc/view/index/indexinfore.html© NTT Communications Corporation All Rights Reserved.

68

Case 2: Phishing Kit discussing SMBC

4. Phishing Content
The following is the code that calls the input page for credit card
information.

© NTT Communications Corporation All Rights Reserved.

smbc/view/index/card.html

69Case 2: Phishing Kit discussing SMBC

4. Phishing Content
If it is confirmed that the input information on the credit card information
input page is correct, proceed to register the information in the database.

smbc/view/index/indexinfore.html© NTT Communications Corporation All Rights Reserved.

70

Case 2: Phishing Kit discussing SMBC

4. Phishing Content
The following is the code that calls the input page for personal identification
information.

smbc/view/index/address.html© NTT Communications Corporation All Rights Reserved.

71

Case 2: Phishing Kit discussing SMBC

4. Phishing Content
Upon pressing the "Next" button on the personal identification information
input page, proceed to register the information in the database.

smbc/view/index/indexinfore.html© NTT Communications Corporation All Rights Reserved.

72

Case 2: Phishing Kit discussing SMBC

4. Phishing Content
The following is the code that calls the input page for 3D Secure
information.

smbc/view/index/sendcode.html© NTT Communications Corporation All Rights Reserved.

73

Case 2: Phishing Kit discussing SMBC

4. Phishing Content
Upon entering 3D Secure information on the 3D Secure information input
page and pressing the "Next" button, proceed to register the information in
the database.

smbc/view/index/indexinfore.html© NTT Communications Corporation All Rights Reserved.

74

Case 2: Phishing Kit discussing SMBC

4. Phishing Content
After displaying the success page, redirect to the configured URL, which inthis phishing kit is the official SMBC website.

smbc/view/index/finish.html© NTT Communications Corporation All Rights Reserved.

75

Case 2: Phishing Kit discussing SMBC

4. Phishing Content
After displaying the success page, redirect to the configured URL, which inthis phishing kit is the official SMBC website.

smbc/view/index/finish.html© NTT Communications Corporation All Rights Reserved.

76

Case 2: Phishing Kit discussing SMBC

5. Acquired Information Management Function

The information entered on the phishing site is stored in a database, andthere is an administration interface to review the accumulated data. (Iattempted to replicate the design based on the source, as trying to launch
it locally resulted in a distorted layout.)

smbc/view/admon/login.html© NTT Communications Corporation All Rights Reserved.

77

Case 2: Phishing Kit discussing SMBC

5. Acquired Information Management Function

A screen is provided to display the acquired information in a list. (I also
couldn't reproduce the screen accurately, so the display is a reconstructed
image based on the source.)

smbc/view/admon/index.html© NTT Communications Corporation All Rights Reserved.

78

Case 2: Phishing Kit discussing SMBC

5. Acquired Information Management Function
The phishing kit utilizes MySQL to store data internally.

▲3D Secure
information▲Credit card
information© NTT Communications Corporation All Rights Reserved.

▲Personal information

79

Case 2: Phishing Kit discussing SMBC

5. Acquired Information Management Function

It also has a function to output the acquired information to a file.

smbc/view/admon/login.html© NTT Communications Corporation All Rights Reserved.

80

Case 2: Summary• The phishing kit named "Mitsui.zip" that imitates SMBC is also
built using Vue.js. It implements cloaking by using information
obtained from external services as a comparative condition.
• Unlike the phishing kit targeting Amazon, it seems that lessemphasis has been placed on crawler detection in this phishing
kit related to SMBC.
• The stolen information is stored in the database on the serverwhere the phishing kit is deployed. Phishing actors can review
the information in a list and perform text file output through theadministration interface.
© NTT Communications Corporation All Rights Reserved.

81

Utilization of Indicators of Compromise• By generating Indicators of Compromise (IoCs) based on thecharacteristics of the phishing kit, it is possible to use themfor hunting in Security Information and Event Management(SIEM) logs and analyzing unknown sites.
• This time, I will introduce "Indicator of Kit" as one of themethods for utilizing intelligence.

© NTT Communications Corporation All Rights Reserved.

82

What's IOK (Indicator Of Kit)?
• IOK (Indicator Of Kit) is an open-source detection rule format
designed for detecting and analyzing phishing sites.
• It is based on the Sigma rule and is used to describe Indicators ofCompromise (IoCs) specifically for phishing sites in YAML format.

https://phish.report/IOK© NTT Communications Corporation All Rights Reserved.

83

What's IOK (Indicator Of Kit)?

• The generated IOK can be submitted as a Pull Request to the GitHub
repository (https://github.com/phish-report/IOK).
• Utilize publicly available indicators to investigate phishing sites that matchthe IoC conditions.

© NTT Communications Corporation All Rights Reserved.

84

What's IOK (Indicator Of Kit)?

• Rules committed to the GitHub repository can be viewed directly throughthe browser at https://phish.report/IOK/indicators.

© NTT Communications Corporation All Rights Reserved.

85

Example of Utilizing IOK (Indicator of Kit)
• On the web interface at https://phish.report/IOK, by inputting IOK into
the Example, and pressing the "Update Rule matches" button, you canretrieve urlscan.io registration results that match the rules specified in IOK.

© NTT Communications Corporation All Rights Reserved.

86Summary• Phishing kits targeting Japan exhibit distinct characteristics foreach kit. However, they commonly incorporate various cloaking
techniques to evade detection and circumvent access by phishinghunters or on-site responders.
• Analyzing the contents of phishing kits has allowed us tounderstand the cloaking techniques implemented by phishingactors to evade detection.
• Generating Indicators of Compromise (IoCs) from phishing kits forinvestigating phishing sites allows for the streamlining of similar
phishing site investigations, enhancing efficiency in the process.
© NTT Communications Corporation All Rights Reserved.

87Agenda1.Recent Phishing Incidents
2.Phishing Communities
3.Phishing Actors' Activities
4.Analysis of Phishing Kits
5.Conclusion© NTT Communications Corporation All Rights Reserved.

88

Conclusion•

In the "phishing community," the buying and selling of tools that simplify the misuse and monetizationof phishing kits and personal information by "phishing actors" is believed to contribute to the divisionof labor in phishing activities. This practice helps establish and maintain a system where various
aspects of phishing are delegated and specialized.

•"Phishing actors," a diverse group of individuals, operate ubiquitously across the surface web, dark web,and various other online platforms. They are active in many places, even in our immediatesurroundings.

•

In the "phishing community," actors with various roles engage in active interactions, transcending
language barriers, to exchange information and collaborate effectively.

•

Each phishing kit has its own characteristics, and by generating and sharing Indicators of Compromise(IoC) based on analysis results (using tools like IOK), it becomes possible to aid in the investigation ofsimilar phishing sites.

•

Indeed, collaboration among defenders is crucial, and together, efforts can be made to mitigate anderadicate phishing incidents.

© NTT Communications Corporation All Rights Reserved.

89Thank you︕
Your comments & feedbacks
are always welcome!
e-mail: ic-na4sec@ntt.com© NTT Communications Corporation All Rights Reserved.

90

References[1] Council of Anti-Phishing Japan, Monthly Report, "2023/11 Phishing Reporting
Status." （2023/12/12）
https://www.antiphishing.jp/report/monthly/202311.html[2] Council of Anti-Phishing Japan, "Anti-Phishing Guidelines 2023 Edition.
（2023/06/01）
https://www.antiphishing.jp/report/antiphishing_guideline_2023.pdf[3] GitHub Repository｜CrawlerDetecthttps://github.com/JayBizzle/Crawler-Detect[4] Phish Report 『Indicator Of Kit（IOK）』
https://phish.report/IOK[5] GitHub Repository ｜Indicator of kit
https://github.com/phish-report/IOK© NTT Communications Corporation All Rights Reserved.

91

Appendix

Directory structure of a phishing kit that talks about Amazon© NTT Communications Corporation All Rights Reserved.

92

Appendix

Directory structure of the phishing kit that talks about SMBC (too many files,
up to the second level)© NTT Communications Corporation All Rights Reserved.

93

Appendix"IOK, a phishing kit discussing Amazon targeting Japan."title: Amazon_Phishing_Detection
description: |Detects a Amazon phishing kit targeting Japanese users.
references:- https://urlscan.io/result/b75b2254-d248-4ab6-ae21-4969e5e9d837
detection:
AppJSContains:
dom|contains:- 'type="text/javascript" src="/static/js/app.'ContentScript:
requests|contains:- '11.8b1570ce205b9a0d5ecb.js'
condition: AppJSContains and ContentScript© NTT Communications Corporation All Rights Reserved.

94Appendix"IOK, a phishing kit discussing SMBC (Sumitomo Mitsui Banking Corporation) targeting Japan."title: SMBC_Phishing_Detection
description: |Detects a SMBC phishing kit targeting Japanese users.
references:- https://urlscan.io/result/e52f427c-1f90-4ad3-990b-ab9d2184dad2
detection:
FormContains:
dom|contains:- 'method="post" action="https://www.smbccard.com/memapi/jaxrs/xt_login/agree/v1" novalidate=""'ChunkVendorsScript:
requests|contains:- 'chunk-vendors.7d63933e.js'
condition: FormContains and ChunkVendorsScript© NTT Communications Corporation All Rights Reserved.

95